Kafka and AMQ Streams Security

Encryption

By default, Kafka transmits data in plaintext, leaving it vulnerable to man-in-the-middle attacks.

• Enable TLS/SSL encryption for all client-to-broker and broker-to-broker communication
• The performance cost of TLS is typically negligible on modern hardware
• TLS only protects data in transit; apply additional controls for data at rest

AMQ Streams Encryption

AMQ Streams encrypts communication between brokers and operators using TLS by default. Client encryption depends on Kafka listener configuration:

• Cluster CA signs broker certificates; Clients CA signs client certificates
• The Cluster Operator automatically generates and renews CA certificates
• Users may provide their own CA certificates (must be renewed manually)
• Client applications must trust Cluster CA certificates unless TLS is explicitly disabled on external listeners